Plan of Action & Milestones
Edit any cell. Milestones, owner, and target date are yours to fill in — the control, weakness, and point value come straight from NIST SP 800-171 Rev 2. New to POA&Ms? Start with the guide →
“SPRS points at stake” is the full point value of every open control — what you'd regain by fully implementing and documenting it. It runs a little higher than the “points in deductions” on the SPRS calculator, which already credits partial progress on 3.5.3 (MFA) and 3.13.11 (FIPS encryption).
| Control | Weakness / deficiency | Pts | Milestones | Owner | Target date |
|---|
Email me my POA&M
We'll send this POA&M to your inbox so you can keep working on it — plus your prioritized SPRS gap report if you ran the calculator. Free.
🔒 Just your POA&M — no spam, no sales calls.
Want the full tracker — plus the policies that close these gaps?
This free tool gives you the POA&M. The CMMC Level 2 Starter Kit generates these same rows into the branded XLSX tracker — alongside your SSP and SPRS score report, built from your own answers and yours to regenerate any time — plus all 14 required policies and a guided playbook. So you're not just listing gaps, you're closing them.
See what's inside →